An ISO 13485 internal audit is a planned check, by someone independent of the work, that your medical device quality system meets the standard, your own procedures and the regulations that apply to your devices. Clause 8.2.4 requires a documented procedure, a risk-based program, impartial auditors, records, and corrective action without undue delay. Most companies cover the whole system once a year.
What clause 8.2.4 requires
ISO 13485:2016 is stricter about internal audits than ISO 9001. The requirements, in our own words:
- A documented procedure that covers planning, conducting, recording and reporting audits.
- A program planned around the status and importance of each process and the results of earlier audits.
- Defined criteria, scope, interval and methods for each audit.
- Auditors who are objective and do not audit their own work.
- Records of the audits and their results, including the processes and areas audited and the conclusions.
- Correction and corrective action by the managers of the audited area, without undue delay.
- Follow-up that verifies the actions and reports the result.
The audit has four sets of criteria: the standard, your own planned arrangements and procedures, the quality system requirements you have set yourself, and applicable regulatory requirements. That last one is the part teams coming from ISO 9001 miss. An internal audit that checks only against ISO 13485 clauses is incomplete.
Which regulations belong in the audit criteria
List the markets you sell in and add the quality system rules for each.
For the United States, FDA's Quality Management System Regulation has incorporated ISO 13485:2016 by reference since February 2, 2026, with additional FDA requirements on top. For the EU, the MDR and IVDR set quality system duties for manufacturers, including post-market surveillance and a person responsible for regulatory compliance. For Canada, class II, III and IV devices need a certificate under the Medical Device Single Audit Program (MDSAP), which also covers Australia, Brazil, Japan and the United States.
You do not have to audit every regulation in full each year. You do have to show that each one is in the program and that the processes it affects were checked against it.
How to plan the program
Start from your process list and rate each process for risk. In a device company, the processes that usually rate high are design and development, production and process validation, purchasing and supplier control, complaint handling and vigilance, and corrective and preventive action.
| Process | Clauses | Typical frequency |
|---|---|---|
| Management responsibility and review | 5 | Yearly |
| Document and record control, medical device file | 4.2 | Yearly |
| Design and development | 7.3 | Yearly, and after each major project milestone |
| Purchasing and supplier control | 7.4 | Yearly |
| Production, process validation, traceability | 7.5 | Yearly; twice for high-risk lines |
| Monitoring and measuring equipment | 7.6 | Yearly |
| Feedback, complaints, reporting to authorities | 8.2.1 to 8.2.3 | Yearly |
| Nonconforming product, CAPA | 8.3, 8.5 | Yearly |
| Quality system software validation | 4.1.6 | Yearly |
The table is an illustration. Your frequencies depend on device risk, on what earlier audits found, and on changes such as a new production line or a new market.
Spread the audits across the year. One audit week before the certification body arrives finds problems too late to fix them, and it shows in the dates on your records.
Who can audit
Auditors must be independent of the work they audit and competent to do it. For ISO 13485, competence means more than audit method. The auditor needs to understand the standard, the regulations in scope and the technology well enough to follow a design file or a validation report.
Small companies struggle with independence. The quality manager cannot audit document control, CAPA or the internal audit process, because those are the quality manager's own. Three options work: a trained colleague from another department audits the quality processes, two companies exchange auditors, or an outside auditor takes those processes for a day or two a year.
Keep a record for each auditor with their training, their experience and the audits they have done. Certification auditors ask for it.
What to check in each process
Design and development
Pick one project and follow it through the design and development file. Look for a plan with stages and reviews, inputs that include regulatory and risk requirements, outputs that can be verified against the inputs, reviews with records of who attended, verification and validation results, and design transfer to production. Then pick one design change and check that it was reviewed, verified and approved before it was used, and that the risk file was updated.
Production and process validation
On the floor, compare what operators do with the current work instructions. Check line clearance, labeling controls and the device history record for one lot. For any process whose output cannot be fully verified afterward, such as sterilization, sealing or welding, ask for the validation report and the date of the last revalidation or review. Check that software used in production was validated before use.
Purchasing
Take three suppliers of different risk. For each, look at how the supplier was selected, what the purchasing information says, whether there is a written agreement that the supplier will notify you of changes, and how incoming product is verified. Check the re-evaluation records against the interval in your procedure.
Complaints, reporting and feedback
Sample complaints from the last year. Each should have an evaluation, a decision on whether it must be reported to a regulator, an investigation or a recorded reason for not investigating, and a link to corrective action where one was needed. Check that reporting decisions were made within the deadlines of each market. Then look at how feedback from production and post-market sources reaches risk management.
CAPA
Read five closed corrective actions end to end. The cause should explain the problem, the action should address the cause, and there should be evidence that someone checked the action worked. Look for actions closed on the day the due date arrived, with no effectiveness check. That pattern is one of the first things an FDA investigator or a notified body auditor looks for.
Management review
Read the last review against the list of required inputs in clause 5.6. Decisions and actions should be recorded, with owners. New or revised regulatory requirements are a required input and are often missing.
How to write and grade findings
A finding states the requirement, the evidence and the gap. "Clause 7.4.1 requires re-evaluation of suppliers. Supplier S-014, a contract sterilizer, was last evaluated in March 2024. Procedure P-12 sets a yearly interval." Nobody can argue with that, and the action is obvious.
ISO 13485 does not define grades. Most companies use major and minor. If you sell into MDSAP countries, consider learning its grading method, which scores each nonconformity from 1 to 5 based on the clause affected and whether the finding is a repeat. Grading your internal findings the same way tells you in advance how an MDSAP audit would read them.
Findings that come up most often
- Design changes made without updating the risk management file.
- Process validations that were never reviewed after equipment or material changes.
- Supplier agreements with no clause on notification of changes.
- Complaints closed without a recorded decision on regulatory reporting.
- CAPA closed without an effectiveness check.
- Training records that show attendance and say nothing about competence.
- Spreadsheets and other quality system software in use without validation.
- Management review held without all required inputs.
If your internal audits never raise any of these, look at how deep the sampling goes before concluding that the system is clean.
Internal audit records and FDA
Under the old FDA Quality System regulation, internal audit reports were shielded from routine inspection. The QMSR removed that exception, so FDA investigators can now ask for internal audit and management review records.
Write every report as if a regulator will read it. That means facts with evidence, clear grading, and corrective actions that were followed up. It does not mean softer findings. A thin audit file with no findings looks worse to an investigator than a full one with problems that were found and fixed.
Frequently Asked Questions
How often are ISO 13485 internal audits required?
The standard says planned intervals and leaves the number to you. In practice, certification bodies expect every process to be audited at least once a year, with more attention to high-risk processes.
Can we outsource ISO 13485 internal audits?
Yes. Many small manufacturers use an outside auditor for the whole program or for the processes their own staff cannot audit independently. The responsibility for the program and for corrective action stays with you.
Do internal auditors need a lead auditor certificate?
No. The standard requires competence and independence. An internal auditor course on ISO 13485 plus supervised audits is a common way to show competence. A lead auditor certificate helps and is not required.
Does the internal audit have to cover regulatory requirements?
Yes. Clause 8.2.4 lists applicable regulatory requirements among the audit criteria, next to the standard and your own procedures.
How is an internal audit different from a mock audit?
An internal audit is a required, recurring part of the quality system. A mock audit is a rehearsal for a specific external audit, run in the style of that auditor. Many companies schedule one internal audit shortly before certification so that it serves both purposes.
Related insights
- ISO 13485 Audit Preparation
- FDA QMSR and the ISO 13485 transition
- How to Hire an ISO 13485 Consultant (and What It Costs)
- ISO 9001 Internal Audit: Program, Plan and Checklist
Get an independent auditor
ElevateQCS matches medical device companies with vetted, independent ISO 13485 auditors for internal audits, mock audits and remediation. Find an ISO 13485 auditor
General guidance aligned with ISO 13485:2016. It is not regulatory advice. Refer to the standard and to the regulations for your markets.
Sources
These references provide standards, regulatory text, or background context. They do not independently validate every recommendation in this article. Linking does not imply endorsement. Standards may require purchase; refer to the publisher for the current text.
